[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-DEBIAN-CVE-2026-64189":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T04:32:17.889Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":16,"duplicates":17,"related":18,"reserved_at":9,"published_at":19,"modified_at":20,"state":9,"summary":21,"references_raw":23,"kevs":30,"epss":9,"epss_history":31,"metrics":32,"affected":33},"DEBIAN-CVE-2026-64189","In the Linux kernel, the following vulnerability has been resolved:  netfilter: ipset: fix race between dump and ip_set_list resize  The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section.  A concurrent ip_set_create() can grow the array: it publishes the new array, calls synchronize_net() and then kvfree()s the old one. Since the dump paths read the array outside any RCU reader, synchronize_net() does not wait for them and the old array can be freed while they still index into it, causing a use-after-free.  The dumped set itself stays pinned via set->ref_netlink, so only the array load needs protecting. Take rcu_read_lock() around it, matching ip_set_get_byname() and __ip_set_put_byindex().    BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)   Read of size 8 at addr ffff88800b5c4018 by task exploit/150   Call Trace:    ...    kasan_report (mm/kasan/report.c:595)    ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)    netlink_dump (net/netlink/af_netlink.c:2325)    netlink_recvmsg (net/netlink/af_netlink.c:1976)    sock_recvmsg (net/socket.c:1159)    __sys_recvfrom (net/socket.c:2315)    ...   Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI   KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7]   RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698)   Kernel panic - not syncing: Fatal exception",null,[],[],[],[14],{"_key":15},"CVE-2026-64189",[],[],[],"2026-07-20T17:18:21.997Z","2026-07-21T15:00:18.096628062Z",{"cisa_kev":22,"cisa_ransomware":22,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[24],{"url":25,"sources":26,"tags":28},"https://security-tracker.debian.org/tracker/CVE-2026-64189",[27],"osv_debian",[29],"Advisory",[],[],[],[34],{"ecosystem":35,"name":36,"vendor":37,"product":36,"cpe_part":9,"purl_type":38,"purl_namespace":37,"purl_name":36,"source":9,"versions":39},"Debian","linux","debian","deb",[40,44,45,49],{"version":41,"is_range":42,"range_type":43,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"version":41,"is_range":42,"range_type":43,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":46,"is_range":42,"range_type":43,"version_start":9,"version_start_type":9,"version_end":47,"version_end_type":48,"fixed_in":9},"lt6_12_96_1","6.12.96-1","excluding",{"version":41,"is_range":42,"range_type":43,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9}]